Resolved issues
21 min
These are cumulative release notes. If a release does not appear in this section, then there were no associated resolved issues.
- Fixed an issue where vulnerability searches retrieved large amounts of unnecessary data when requesting the required vulnerability fields. A new response option now retrieves only the required fields for Neurons Patch, including threat type, categories, title, and origin, allowing multiple vulnerability documents to be requested without retrieving unused data.
- Fixed an issue with the ORCA integration caused by changes in newer versions of the Inventory and Alert APIs. The connector has been updated to support the latest API endpoints, request and response formats, and enhanced parsing logic, ensuring reliable data retrieval and successful end-to-end integration with ORCA.
- Fixed an issue in the VRR Trend chart where month labels were not consistently aligned with their corresponding data points.
- Fixed an issue in the Cortex Xpanse Expander V2 integration where vulnerability findings could not be reliably correlated with specific CVEs. This issue resulted in incomplete vulnerability attribution, duplicate findings, and status inconsistencies. Updated finding mapping now provides more accurate correlation and tracking of vulnerability findings in RBVM.
- Fixed an issue where the Orca connector used legacy Sonar API endpoints that are being deprecated by Orca. The connector now uses supported Service Layer API endpoints, ensuring reliable data retrieval and ongoing integration compatibility.
- Improved the performance of the Calc Severity job by streamlining how severity data is processed. This enhancement reduces unnecessary processing and helps severity calculations complete more efficiently.
- Fixed an issue that caused the Vulnerability Subject Search API to fail in certain scenarios when limiting returned items.
- Resolved an issue where item limits in the Vulnerability subject search API caused failures in certain scenarios.
- Resolved an issue where the Patch Tuesday job failed to obtain the Neurons authorization token. Additional filtering-related issues have also been addressed.
- Previously, Playbook Description was not displayed in the Playbook Detail pane. This issue is fixed now.
- Previously, CMDB Details were not displayed properly for Host Details. This issue is fixed now.
- Resolved an issue in the RBVM Auto Ticketing connector configuration for ITSM where the closure field and its values were not saved during findings collection setup. This prevented the auto-closure functionality from working as expected.
- Resolved an issue where the Orca Scanner plugin aggregated multiple CVEs under a single Alert ID per host, causing performance bottlenecks in the SCAP database. The plugin has been refactored to process each CVE as an individual finding, enabling a 1:1 mapping between Orca Vulnerability View and RBVM Host Findings.
- The SLA Impact and SLA Performance sections were not displayed in the SLA detail pane. This issue is fixed now.
- Resolved an issue where findings could exhibit a “toggle effect” when multiple scan types (for example, Agent and IP scans) contributed to the same assessment. To ensure consistency, ingestion of findings is now skipped if the incoming discovery time is earlier than the existing finding’s discovery time.
- Started reading the IPv6 details from Qualys VMDR connector pulled files, but still it was not propagated to findings which is being fixed now.
- InsightVM Connector - Fixed an issue where vulnerabilities could close prematurely; the system now considers the most recent evidence before closing.
- Addressed the ServiceNow Connector issue which mandates ‘Invoice Number’ field that is not relevant.
- Addressed the JIRA Connector sync issue.
- Addressed the InsightVM Connector import issue.
- apiExport Endpoint enhanced to include custom attribute(s) data.
- Fixed an issue in the risk acceptance workflow that occurred when updating to the "reworked" state.
- Inconsistencies in approver listings during workflow creation.
- AWS InspectorV2 Integration duplicate findings issue.
- Veracode metadata (Team email) updation issue.
- VulnKB "CVE Updated on" date inaccuracy issue.
- Resolved issues with approver listings during workflow creation.
- Application data ingestion issues are resolved.
- The "Preferences" and "Actions" buttons on the Notifications main page are updated for better usability.
- Findings Plugin Links Formatting Issue
- Resolved display issue where links in the Description and Plugin Output sections of host findings were showing raw HTML code instead of clickable links.
- Verified that links now render correctly and are available in these sections, matching functionality seen in the "Possible Patches" area.
- Rapid7 IVM CVEs Field - Data Not Imported
- Fixed issue where CVE data from Rapid7 InsightVM was not populating the primary "CVEs" field in RBVM.
- The parser now populates the "CVEs" field with the same CVE information found in the "InsightVM CVES" field.
- OOTB dashboards and widgets (such as the Weaponization Funnel) now accurately reflect the number of unique CVEs identified, ensuring proper reporting and visibility.
- Verified that links now render correctly and are available in these sections, matching functionality seen in the "Possible Patches" area.
- Underlying systemic issue causing intermittent failures in “Decommissioned Assets” playbook addressed and fixed.
- CWE Top 25 Filter Issues on Vulnerabilities Page: Resolved an issue where filtering by "CWE Top 25/Has CWE Top 25" was not returning results or autosuggestions on the Vulnerabilities page of "Vulnerability KB".
- ServiceNow Connector: Unfillable Required Field: Addressed an issue where the ServiceNow Incident connector was incorrectly requiring an "invoice" field, which is not relevant for some organizations. For affected clients, the connector now fetches fields only from the incident table (not the task table), matching client workflows.
- Resolved issue where CVSS3 scores were not populating in the platform from Veracode for the veracode JSON parser.
- Updated SLA Group suggestion logic to exclude groups already assigned to an SLA, ensuring groups can only be mapped to a single SLA at a time.
- Fixed issue where SLA playbook triggers were not being cleared when an SLA was disabled, causing outdated jobs to block SLA execution upon re-enabling. Now, disabling an SLA clears all related triggers to prevent this race condition.
- Resolved the issue with Checkmarx SAST connector where additional projects couldn't be added despite correct search results being pulled.
- Incorrect Due Dates Being Assigned:
- Addressed an issue where due dates for asset findings were calculated incorrectly based on Risk Tolerance Matrix rules.
- Ensured proper alignment between severity scoring, asset criticality, and expected due date rules.
- Filter Operators Missing for 'Nessus Resurface Date' Field:
- Resolved inconsistencies in available filter operators for the "Nessus Resurface Date" field in host findings.
- Added comparable operators (e.g., equals, less than, greater than) to ensure parity with other date-related filter fields like "First Discovered Date."
- RS3 Timeline Locks Date Range: Resolved an issue where the RS3 Timeline widget's date range remained static instead of dynamically reflecting the 30-day rolling date range when viewed.
- Incorrect "Last Discovered On" Dates in Host Findings: Fixed discrepancies where "Last Discovered On" dates for host findings were incorrect and did not align with expected values from Qualys scan results.
- BETA Veracode Connector Not Pulling Files: Resolved a bug causing the Veracode connector to freeze and fail to pull data after the recent Veracode release update.
- Incomplete Manual Pentest Findings in Veracode V2 Connector: Fixed an issue where certain applications and findings, particularly those categorized under "Manual Pentest Findings" (MPT), were not consistently ingested into the Veracode V2 connector.
- Prisma Cloud Connector Missing Kubernetes Version Field: Addressed an issue where Kubernetes version information was not being ingested from Prisma Cloud for hosts, enabling better reporting and version control.
- Default View Update Fix: Resolved an issue where updating a shared default view reverted the default to "Client Defaults." Default views now persist after updates.
- Latin Characters in File Uploads: Addressed an issue causing file upload failures when application or service names contained Latin characters with accents (e.g., "ó," "ñ"). Latin characters in these fields are now fully supported during uploads.
- Crowdstrike Connector Tag Filtering: Added a backend feature for Crowdstrike Connector to support tag-based filtering, allowing clients to limit data import to reduce unnecessary findings and improve platform performance.
- Snyk Data Ingestion Discrepancy: Improved alignment of Snyk data ingestion to include findings across sandbox and production environments. This resolves inconsistencies in finding counts and filters.
- Workflow State Change Configuration Issue: Fixed an issue preventing users from creating "Workflow State Change Configuration" when selecting the "All Workflows" option in the UI. These configurations are now handled correctly.
- Playbook Failure Debugging: Addressed an issue where the "PLAYBOOK_RULE_TARGET_RESTRICTION_BYPASS" flag-enabled playbooks still failed despite successfully updating target assets. Enhanced playbook logging and error reporting to ensure stability.
- Latin Characters Rendering in UI: Fixed display issues in the RBVM UI where Latin characters with accents (e.g., "ü," "ñ") caused errors in titles and list views. These characters are now rendered correctly across all supported sections of the UI.
- CVSSv4 Data not getting populated for some CVEs.
- In the “Group SLAs by Due Dates” widget, the columns that show findings overdue “more than” a certain number of days now uses the “BEFORE” operator.
- If the NETBIOS value contains a slash, the NETBIOS column on the Host and Host Findings pages only shows a single slash instead of two.
- The system now successfully creates tickets for an auto-ticketing configuration based on a Group By over finding Title. The solution changes the tag name format for tags associated with tickets.
- Crowdstrike Falcon Spotlight and Microsoft Defender assets will not be marked as “RiskSense-archived” or “system-archived” if seen in the last 30 days.
- An issue has been resolved that prevented some Prismacloud files from being processed correctly.
- Crowdstrike Falcon Spotlight and Microsoft Defender hosts will not be marked as “risksense-archived” if seen within the last 30 days.
- An issue has been resolved that prevented findings from receiving titles.
- Alignment issues for the “Workflow Automation Disabled” notification preferences page have been addressed.
- Users with just Finding Collection Control will be able to create an auto-ticketing configuration for a finding collection without seeing any errors.
- On the Vulnerabilities page of Vulnerability KB, the user can now export all records for a filter on Vulnerability KB that contains the wildcard (*) operator.
- Users can no longer add the percentage metrics (e.g. “Open Host Findings %”) to Group Performance over Time.
- The bell notification will now show an accurate count of unread notifications even if the count reaches > 20 notifications.
- The Wiz, InsightVM, and Palo Alto Cortex Xpanse connectors will now be able to sync successfully.
- If you change the name of a dashboard, the new name will now immediately appear in the navigation breadcrumbs near the top.
- In the Finding Details, the Scope Override Authorization will not show a lock icon next to the value of “Authorized”.
- Custom dashboards that show many Group RS³ widgets will now load more quickly.
- The InsightVM connector will now successfully ingest tags.
- In the Finding Details, the UI now shows the in-platform name for the workflow type instead of the API value.
- The platform can now update the OS version for a host if it receives a scan with more up-to-date information.
- An issue preventing some application findings from being accurately recorded has been resolved. This issue occasionally prevented widget links that filtered the Application Findings page from working correctly.
- The “Ransomware Affected Assets” widget will now filter on address type if the user clicks to view internal or external assets.
- Tenable.sc will now process files automatically and no longer report a unknown error when processing files from a connector pull.
- The import users CSV template will now download correctly from the Import Users dialog.
- When the system is syncing ticket information for Service Now Incident it will no longer add the plugin information to the Description and Short Description when they are not selected.
- When ingesting Tanium data it will now correctly add it to a Mixed Network.
- Change the term “Whitelist” under client settings to “Allow List”.
- The ASPM logo has now been added to login page.
- The text when a custom attribute is being process has now be revised to provide the max number of assets per job.
- When creating a finding article from the Detail pane of a finding it will now apply to that finding.
- If a user provides a generic upload file with a “asset-only” mapping, the Validate Mapping step will now only show asset fields.
- Automated workflows will clearly state that the expiration date of a workflow can be no more than 10 years in the future.
- Automated workflows will not count toward a user’s playbook total.
- Remediated findings for Wiz should now show the correct “Last Discovered On” dates in Ivanti Neurons. Changes to the Wiz UrBA process have been made so that Ivanti Neurons can better respond to findings impacted by Wiz data retention policies.
- Tenable.io and Wiz assets should now be correctly marked as “risksense-archived” if Ivanti Neurons does not ingest them for 30 days.
- The filter “Past Due” will return only findings that are overdue.
- Changes to the Finding Collection description will now always show up in within the UI.
- In the Workflow Updates section of the Workflow detail pane, the date of the last update will now reflect the most recent update regardless of whether the submission changes the workflow state.
- Jobs that remove multiple assets from groups will now complete successfully.
- Bulk deletes of findings will now complete successfully.
Miscellaneous Changes
- Users can now set default address type for network assets without an IP address in Client Settings.
- All clients now have the ability to enable the MetricStream GRC connector. This connector allows users to create a ticket in MetricStream for every Risk Acceptance workflow. Rather than approving the workflow within Ivanti Neurons, the organization approves the workflow within MetricStream.
- All clients can now enable the Rapid7 InsightVM connector. Findings and assets will appear within the Host Findings and Host pages respectively. For more information on this connector, view the Rapid7 InsightVM connector guide.
- All clients can now enable Microsoft Defender for Endpoint. Findings and assets will appear within the Host Findings and Host pages respectively. For more information, view the Microsoft Defender for Endpoint connector guide.
- The field “Nessus Check Type” will now be available on the Host Findings page.
- An issue was resolved with the Cherwell ticket creation caused by customized Category and Subcategory field names.
- Application finding counts will now be correct for Fortify On Demand DAST and SAST findings.
- An issue has been resolved with the calculation of SLA dates for application findings caused by a previous job failure.
- Cherwell tickets will no longer be created with <br> tags.
- Column order will successfully be saved when a saved view is updated.
- Long filenames will no longer cause issues with processing Tenable Security Center uploads.
- UrBA will now be automatically enabled for Amazon Inspector connector assessments.
- Whitespace will be trimmed from plugin IDs during the ingestion process.
- Users can now edit existing playbooks even when the client has reached the maximum number of playbooks allowed.
- The “Mean Time to Remediate” (MTTR) bar charts show the average remediation time for all findings as a yellow line atop the scoring metric group breakdown. The MTTR shown by that line should now match the MTTR KPIs, assuming both widgets use the same filters and timeline settings.
- When a user modifies only the description of a finding collection, ticketing will not automatically be enabled when the new description is saved.
- When a user filters a dashboard on a tag only present on findings (and consequently makes the asset count 0), the “Findings Prioritization Funnel” widget will still show colored bands for the scoring metric distribution.
- The widgets “Findings Summary”, ”Findings First Discovered vs. Resolved”, and
- ”Findings First Ingested vs. Resolved” will now accept dashboard filters until a user configures a widget-level group filter. When the widgets filter on “all groups” that match dashboard filters, they no longer show an indicator on the front.
- The system should now be able to ingest files with CPE lists of more than 65000 characters.
- MetricStream tickets will now be created with a status of “Save and Continue” to enable editing.
- Workflow Automation Disabled email notifications will display the name of the workflow correctly.
- The date displayed on the Generate API Token window and in the API token table will now match.
- Users can now successfully update approved workflows to halt automation.
- Cards for rejected workflows, which cannot expire, will no longer show the expiration clock icon.
- An issue with question marks appearing in Cherwell ticket fields has been resolved.
- The platform will correctly translate the status of Qualys Policy Compliance findings to Open or Closed for findings in Ivanti Neurons.